[PR #37] [MERGED] Release/202506.003 #48

New issue

Closed

opened 2026-10-15 13:01:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:56 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/wolfmanager/pull/37
Author: @salty2011
Created: 6/15/2025
Status: ✅ Merged
Merged: 6/16/2025
Merged by: @salty2011

Base: stable ← Head: release/202506.003

📝 Commits (10+)

c609391 chore: update Docker build workflow to support preview and production tagging
7ba0d8c security: fix tar-fs directory traversal vulnerability (CVE)
1eea14f security: fix Babel RegExp complexity vulnerability (CVE)
240a624 security: fix PrismJS DOM Clobbering vulnerability (CVE)
df4a4b0 security: fix undici Denial of Service vulnerability (CVE)
1002f16 security: fix cookie out-of-bounds characters vulnerability (CVE)
ecbf5eb security: fix Next.js middleware header leak vulnerability (CVE)
ec9e18b Merge pull request #19 from games-on-whales/security/202506.003-fixes
009f4af FIX: Build pipeline
927c98f Revert "Security/202506.003 fixes"

📊 Changes

123 files changed (+20757 additions, -2359 deletions)

View changed files

📝 .dockerignore (+7 -1)
📝 .env.example (+56 -1)
📝 .github/workflows/docker-build.yml (+85 -16)
📝 .gitignore (+7 -1)
📝 README.md (+158 -4)
📝 build/Dockerfile (+13 -4)
📝 build/README.md (+103 -1)
📝 build/docker-compose.production.yml (+6 -3)
📝 build/docker-compose.yml (+10 -1)
📝 build/docker-entrypoint.sh (+21 -0)
📝 docs/README.md (+46 -26)
➕ docs/development.md (+552 -0)
➕ docs/guides/development.md (+552 -0)
➕ docs/quick-start-auto-generation.md (+136 -0)
➕ docs/security/auto-secret-generation.md (+217 -0)
➕ docs/styling-reference.md (+549 -0)
➕ docs/technical/database-architecture.md (+445 -0)
➕ docs/technical/database-quick-reference.md (+527 -0)
➕ docs/technical/pairing-functions-consolidation-plan.md (+207 -0)
➕ docs/wolfmanager-components.md (+670 -0)

...and 80 more files

📄 Description

Summary

This PR merges 30 commits from the release/202506.003 branch into stable, preparing for the upcoming 2025-06 release. It includes several new features, numerous improvements, and critical security patches to ensure a stable and secure deployment.

New Features

Automatic NEXTAUTH_SECRET and ENCRYPTION_KEY Generation: Implements cryptographically secure auto-generation of authentication secrets and encryption keys for NextAuth and application encryption, seamlessly integrated into the build and runtime process.
SQLite Integration via Drizzle ORM: Adds support for SQLite with Drizzle ORM, enabling performant, structured storage and queries for user and client data.
Enhanced Documentation Structure: Reorganized documentation with a clear hierarchy and added security guides for auto-secret generation and database architecture.

Improvements & Changes

Client Management Fixes: Corrected Wolf client ID comparisons, improved client pairing persistence, and refined client deletion and UI integration.
Console & Logger Cleanup: Removed excessive debug logs, optimized middleware matchers, and standardized structured logger usage to reduce noise by ~80%.
Branding Standardization: Renamed all wolf-ui and wolf-admin references to wolfmanager for consistent branding across code, Docker configurations, and log outputs.
Documentation Updates: Removed outdated docker pull from README, updated quick-start and development documentation, and organized guides for better discoverability.

Security Fixes

Directory Traversal Vulnerability (tar-fs CVE): Updated dockerode and enforced tar-fs >= 2.1.3 to prevent path traversal during extraction.
RegExp Complexity Issue (Babel CVE): Forced @babel/runtime >= 7.26.10 to mitigate ReDoS vulnerabilities in generated code.
DOM Clobbering (PrismJS CVE): Updated prismjs to 1.30.0 to eliminate DOM Clobbering risks in syntax highlighter dependencies.
Denial of Service (undici CVE): Upgraded undici to ^7.5.0 to address DoS via malformed certificate data.
Cookie Parsing Vulnerability (cookie CVE): Updated cookie to 0.7.2, preventing out-of-bounds characters in cookie attributes.
Header Leak Issue (Next.js CVE): Patched next and eslint-config-next to 14.2.26, blocking middleware header leaks to external hosts.

Closes Issues

This PR closes the following GitHub issues:

Closes #11
Closes #15
Closes #16
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/wolfmanager/pull/37 **Author:** [@salty2011](https://github.com/salty2011) **Created:** 6/15/2025 **Status:** ✅ Merged **Merged:** 6/16/2025 **Merged by:** [@salty2011](https://github.com/salty2011) **Base:** `stable` ← **Head:** `release/202506.003` --- ### 📝 Commits (10+) - [`c609391`](https://github.com/games-on-whales/wolfmanager/commit/c609391cbf19b01b43814ea6cbc233dc625b7a3a) chore: update Docker build workflow to support preview and production tagging - [`7ba0d8c`](https://github.com/games-on-whales/wolfmanager/commit/7ba0d8ce011e4b80ee2c579960dcd693dccf945c) security: fix tar-fs directory traversal vulnerability (CVE) - [`1eea14f`](https://github.com/games-on-whales/wolfmanager/commit/1eea14f3732fb979bc91aff683ac09d134f237cf) security: fix Babel RegExp complexity vulnerability (CVE) - [`240a624`](https://github.com/games-on-whales/wolfmanager/commit/240a62454ac0233c39071ad137db763e662662ba) security: fix PrismJS DOM Clobbering vulnerability (CVE) - [`df4a4b0`](https://github.com/games-on-whales/wolfmanager/commit/df4a4b04adf20d822e1a27a47fd3de9743426d1f) security: fix undici Denial of Service vulnerability (CVE) - [`1002f16`](https://github.com/games-on-whales/wolfmanager/commit/1002f168485797fca41c58cd54d442efe1d03853) security: fix cookie out-of-bounds characters vulnerability (CVE) - [`ecbf5eb`](https://github.com/games-on-whales/wolfmanager/commit/ecbf5ebdce3712d1be043327aeeaedd2a9ef5d80) security: fix Next.js middleware header leak vulnerability (CVE) - [`ec9e18b`](https://github.com/games-on-whales/wolfmanager/commit/ec9e18bc0549fb0cb407205b8214d12594016d25) Merge pull request #19 from games-on-whales/security/202506.003-fixes - [`009f4af`](https://github.com/games-on-whales/wolfmanager/commit/009f4af6a86581203f9133ad2d8481e3157794a3) FIX: Build pipeline - [`927c98f`](https://github.com/games-on-whales/wolfmanager/commit/927c98f2724eae9f033222c0bf3b2e574272c01e) Revert "Security/202506.003 fixes" ### 📊 Changes **123 files changed** (+20757 additions, -2359 deletions) <details> <summary>View changed files</summary> 📝 `.dockerignore` (+7 -1) 📝 `.env.example` (+56 -1) 📝 `.github/workflows/docker-build.yml` (+85 -16) 📝 `.gitignore` (+7 -1) 📝 `README.md` (+158 -4) 📝 `build/Dockerfile` (+13 -4) 📝 `build/README.md` (+103 -1) 📝 `build/docker-compose.production.yml` (+6 -3) 📝 `build/docker-compose.yml` (+10 -1) 📝 `build/docker-entrypoint.sh` (+21 -0) 📝 `docs/README.md` (+46 -26) ➕ `docs/development.md` (+552 -0) ➕ `docs/guides/development.md` (+552 -0) ➕ `docs/quick-start-auto-generation.md` (+136 -0) ➕ `docs/security/auto-secret-generation.md` (+217 -0) ➕ `docs/styling-reference.md` (+549 -0) ➕ `docs/technical/database-architecture.md` (+445 -0) ➕ `docs/technical/database-quick-reference.md` (+527 -0) ➕ `docs/technical/pairing-functions-consolidation-plan.md` (+207 -0) ➕ `docs/wolfmanager-components.md` (+670 -0) _...and 80 more files_ </details> ### 📄 Description ## Summary This PR merges 30 commits from the `release/202506.003` branch into `stable`, preparing for the upcoming 2025-06 release. It includes several new features, numerous improvements, and critical security patches to ensure a stable and secure deployment. ## New Features * **Automatic NEXTAUTH\_SECRET and ENCRYPTION\_KEY Generation**: Implements cryptographically secure auto-generation of authentication secrets and encryption keys for NextAuth and application encryption, seamlessly integrated into the build and runtime process. * **SQLite Integration via Drizzle ORM**: Adds support for SQLite with Drizzle ORM, enabling performant, structured storage and queries for user and client data. * **Enhanced Documentation Structure**: Reorganized documentation with a clear hierarchy and added security guides for auto-secret generation and database architecture. ## Improvements & Changes * **Client Management Fixes**: Corrected Wolf client ID comparisons, improved client pairing persistence, and refined client deletion and UI integration. * **Console & Logger Cleanup**: Removed excessive debug logs, optimized middleware matchers, and standardized structured logger usage to reduce noise by \~80%. * **Branding Standardization**: Renamed all `wolf-ui` and `wolf-admin` references to `wolfmanager` for consistent branding across code, Docker configurations, and log outputs. * **Documentation Updates**: Removed outdated `docker pull` from README, updated quick-start and development documentation, and organized guides for better discoverability. ## Security Fixes * **Directory Traversal Vulnerability (tar-fs CVE)**: Updated `dockerode` and enforced `tar-fs` >= 2.1.3 to prevent path traversal during extraction. * **RegExp Complexity Issue (Babel CVE)**: Forced `@babel/runtime` >= 7.26.10 to mitigate ReDoS vulnerabilities in generated code. * **DOM Clobbering (PrismJS CVE)**: Updated `prismjs` to 1.30.0 to eliminate DOM Clobbering risks in syntax highlighter dependencies. * **Denial of Service (undici CVE)**: Upgraded `undici` to ^7.5.0 to address DoS via malformed certificate data. * **Cookie Parsing Vulnerability (cookie CVE)**: Updated `cookie` to 0.7.2, preventing out-of-bounds characters in cookie attributes. * **Header Leak Issue (Next.js CVE)**: Patched `next` and `eslint-config-next` to 14.2.26, blocking middleware header leaks to external hosts. ## Closes Issues This PR closes the following GitHub issues: * Closes #11 * Closes #15 * Closes #16 * Closes #19 * Closes #20 * Closes #21 * Closes #22 * Closes #23 * Closes #24 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 13:01:56 +00:00